A hacker story

Date: April 25, 2005
Source: CIO Asia
By: Art Jahnke

Page 1 2

... hack, and offer to fix the networks' vulnerabilities for a price. Ivanov says he persuaded three companies that he could help them patch vulnerabilities in their networks. He did this, he says, and they paid him cash, from US$80 to US$4,000. One of those companies, the Seattle-based CTS, also gave Ivanov storage space on its servers. Ivanov says a fourth company promised to pay but did not. That company, he says, later suffered from the destruction of data.

Ivanov was also working on a way to transfer money from one bank to another and had recently cracked the security of an online casino. The hackers were working hard, up to 16 hours a day, he says. But it was paying off. In a six-month period, says Ivanov, they scammed US$150,000. It was a very exciting time, he says. The Internet had delivered to him, in a polluted factory city in the Ural Mountains, the promise of both untold riches and untold challenges. Ivanov wasn't sure which he liked best.

At the same time, he was wrestling with a major personal decision. In June of 2000, he had received an e-mail from a company in Seattle. The company had challenged him to hack into its site. When Ivanov did that, the strangers asked if he would consider relocating to Seattle. The company said it was in the market for "security talent," a deliberately vague phrase that could easily be read to mean "hacker." Ivanov appeared to have the kind of talent they were after.

He knew that in the long run, the Seattle job could be even more rewarding than his eBay "rate the buyer" scam. So in November, with the eBay function not quite ready to go, he said good-bye to his family and boarded a plane for Seattle. Once he was in his seat, he says, he started ordering drinks. He was pleased to be bound for a new life in a new country with a new job for a company with the curious name of Invita Security.

WHEN FBI AGENTS, posing as Invita employees, watched Ivanov and Gorshkov demonstrate their skills, they were learning more than the two Russians knew. The agents had placed a "sniffer" on the computer keyboard, and as the Russians typed the user names and passwords needed to get into the network of tech.net.ru, the device recorded the keystrokes. With that knowledge, the FBI was able to download some 2,700MB of data to be used as evidence.

The agents had a very good idea of what they were looking for. The FBI had been contacted by several companies that believed they had been targeted by something called the Expert Group of Protection Against Hackers. The organization, made up of dozens of hackers in several Russian cities, operated the same way Ivanov did, exploiting a vulnerability in Microsoft NT server software to break into the networks of U.S. corporations. At first, the feds believed that Ivanov and Gorshkov were part of the group, and that they might be working with the Russian mob; the government has since backed off those allegations.

The FBI's download, the cornerstone of the government's case against the hackers, did not go unchallenged into the federal courts, or, for that matter, into the annals of U.S.-Russian relations. When the FBI broke into the Russian computers, they did so without two important sanctions: One was the permission or cooperation of Russian authorities; the other was a search warrant, which was not acquired until three weeks after the download. Whether the Justice Department attempted to coordinate the investigation with Russian authorities remains a subject of dispute. Federal agents have testified that they attempted to work with Russian authorities, but that their communications went unanswered. The Russians say there was no such effort and claim the download violated a 1997 agreement among G-8 nations that mandates "investigation and prosecution of international high-tech crimes must be coordinated among all concerned states, regardless of where harm has occurred." Russian authorities have reportedly issued arrest warrants for the agents involved.

Once it entered the federal court system, the case against Vasiliy Gorshkov moved quickly to conclusion. Gorshkov was tried in Washington state, where U.S. District Judge John C. Coughenour was unreceptive to arguments that the FBI overstepped its search and seizure authority. In Coughenour's opinion, the data on computer drives in Chelyabinsk was not protected by the Fourth Amendment. The decision meant that federal agents had the right to break into computers in other national jurisdictions, as long as it was for purposes of law enforcement. It also meant that Gorshkov had little hope of beating the rap. And he didn't.

Ivanov's legal journey would follow a different path. Because one of the companies he offered to "help" was based in Connecticut, his case was moved to Hartford. A veteran defense attorney named C. Thomas Furniss was appointed to represent Ivanov. Furniss brought on board a young lawyer and former technology worker named Morgan Rueckert. Rueckert was intrigued by the case, which he suspected would test some of the nascent limits of cyberlaw.

"This was the first case in which the government used methods like these," explains Rueckert. "They set up a fake company and then solicited a job application. They used that method to bypass what you could call a deficiency in extradition agreements."

Rueckert believes that the warrantless search of Ivanov's computer in Russia was also a first. In defending that search, prosecutors claimed that if they had not acted swiftly—more swiftly than the time it would take to get a warrant—the incriminating data would have been destroyed. While that may be true, says Rueckert, the government also failed to get a warrant when it asked CTS to hand over the data that Ivanov had stored on its servers.

"In that instance," says Rueckert, "the government may have violated the Electronic Communications Privacy Act."

While Rueckert examined the privacy issues, defense lawyer Furniss fixed on a larger target. His first motion was to dismiss on the grounds that the government lacked jurisdiction. The question is, says Furniss, "Does Congress intend the criminal statute...to be applied extraterritorially? It's an interesting question and some of the law in this area goes back to the 1700s, when pirates were attacking U.S. ships. In fact, as I read them, the Computer Crime statutes before 1996 really could not be said to reflect that intent, but there have been some amendments."

Curtis Karnow, a partner at the law firm of Sonnenschein Nath &Rosenthal and an expert on extraterritorial jurisdiction, says Furniss's motion was a good one, a sensible tactic that is often tried but never works. As it turned out, it didn't work with U.S. District Judge Alvin Thompson either. And it didn't much matter, once the prosecution pointed out that Ivanov had, for some of his exploits, used at least one proxy server located in the United States. It was all Judge Thompson needed to hear. For this case at least, the defendant had effectively perpetrated criminal acts within the United States. That ruling, along with several other issues (such as the prospect of four more trials in other jurisdictions), persuaded Ivanov and his legal team that a guilty plea would be the best way out.

Rueckert agrees that a plea was a good choice for his client, even if it did leave unresolved some important issues of privacy, cyberlaw and the modus operandi of law enforcement. "Number one," he says, "is about the way the government got data from CTS. The issue there is the individual's expectation of privacy concerning data that is stored remotely. What process should the government have to obtain access to this kind of data? Secondly, should the government be required to obtain a search warrant, and should the defendant be given legal protections? What kind of notice should the government give? There is also the issue of the method the government used to [ensnare Ivanov]. I think that the method they used offended a lot of people outside the United States. All of these issues are important."

As significant as those legal issues are, Rueckert admits that for him, the most captivating aspects of cybercrime are psychological. "The thing that fascinated me here," he says, "was that in Internet crimes you can have a kid, basically, sitting in his basement halfway around the world, and with the click of a mouse, he can cause incredible concern, fear and economic damage all across the country. And the person who is doing it doesn't really see the results. It can be very easy for someone like that to view what they're doing as a game."

Alexey Ivanov doesn't disagree. Hacking was a challenge, and challenges are always fun. It was also, in a strange and roundabout way, a means to what Ivanov says is a happy ending.

Page 1 2

Original article